一句话：提出基于补丁尾部调用序列（TCS）特征的定向差分模糊测试方案，高效复现 1-day 漏洞。
1-day 漏洞在现实中十分常见：攻击者可利用已发布的补丁反推漏洞并加以利用，因此防御方复现这些漏洞（例如拦截攻击流量）同样重要。本文关注的核心问题是：安全补丁具有什么独有特征。作者通过大规模实证研究发现，补丁的一个普遍且独特的特征是尾部调用序列（trailing call sequence, TCS）。基于该特征，论文提出定向差分模糊测试方案 1dFuzz，包含三个组件：通过静态分析定位候选补丁位置的 1dLoc、面向定向模糊测试的 TCS 距离度量，以及在模糊测试过程中捕获 1-day 漏洞 PoC 的新型 sanitizer 1dSan。作者在 11 种不同设置下对真实软件漏洞进行了系统评估，结果表明 1dFuzz 显著优于现有最优基线，最多可多发现 2.26 倍的 1-day 漏洞，且耗时缩短 43%。
1-day vulnerabilities are common in practice and have posed severe threats to end users, as adversaries could learn from released patches to find them and exploit them. Reproducing 1-day vulnerabilities is also crucial for defenders, e.g., to block attack traffic against 1-day vulnerabilities. A core question that affects the effectiveness of recognizing and triggering 1-day vulnerabilities is what is the unique feature of a security patch. After conducting a large-scale empirical study, we point out that a common and unique feature of patches is the trailing call sequence (TCS) and present a novel directed differential fuzzing solution 1dFuzz to efficiently reproduce 1-day vulnerabilities in this paper. Based on the TCS feature, we present a locator 1dLoc able to find candidate patch locations via static analysis, a novel TCS-based distance metric for directed fuzzing, and a novel sanitizer 1dSan able to catch PoCs for 1-day vulnerabilities during fuzzing. We have systematically evaluated 1dFuzz on a set of real-world software vulnerabilities in 11 different settings. Results show that 1dFuzz significantly outperforms state-of-the-art (SOTA) baselines and could find up to 2.26x more 1-day vulnerabilities with a 43% shorter time.
@inproceedings{YangHCMLXCZ23,
title = {1dFuzz: Reproduce 1-Day Vulnerabilities with Directed Differential Fuzzing},
author = {Songtao Yang and Yubo He and Kaixiang Chen and Zheyu Ma and Xiapu Luo and Yong Xie and Jianjun Chen and Chao Zhang},
booktitle = {ISSTA},
year = {2023},
doi = {10.1145/3597926.3598102}
}